CyberRota Analysis
AI-GeneratedThe Undertow AJP listener is vulnerable as it accepts forged SSL certificate attributes without requiring shared-secret authentication, allowing unauthenticated attackers with direct TCP access to port 8009 to bypass CLIENT-CERT authentication. This could lead to unauthorized access and potential exploitation of systems relying on this configuration. Organizations using Undertow with AJP should prioritize addressing this vulnerability to mitigate the risk of unauthorized access.
Original NVD Description
the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol.